humanish 0.132.0 → 0.133.1

package/dist/actors/computer-use/wait.js

@@ -2,8 +2,8 @@
 // longest (actor.maxWaitMs) and how long a wait that names no duration lasts while the participant
 // only waits (actor.idleWaitMs). The loop asks planWait for each wait. A turn with another action
 // sends its waits to the desktop in steps one desktop call carries; a turn that only waits watches
-// the screen instead (loop/watch.ts), for its waits' lengths, the named ones together up to
-// watchMaxMs, or longer as the watches of idle turns in a row grow.
+// the screen instead (loop/watch.ts), for its waits' lengths and at least idleWaitMs, the named
+// ones together up to watchMaxMs, or longer as the watches of idle turns in a row grow.
 export const CUA_WAIT_LIMITS = Object.freeze({
     /**
      * The longest wait one desktop call is given. A browser-control request must be answered within
@@ -26,16 +26,18 @@ export const CUA_WAIT_LIMITS = Object.freeze({
     defaultWatchMaxMs: 600_000,
     /**
      * How long a wait that names no duration lasts in a turn that only waits or takes screenshots,
-     * when a study does not set actor.idleWaitMs. OpenAI's computer-use `wait` names no duration. A
-     * participant told to wait about a minute sent ten in one turn, which lasts 50 s at this length;
-     * one wait a turn makes a one-minute wait about six turns. It is also how often a watch looks.
+     * when a study does not set actor.idleWaitMs. OpenAI's computer tool `wait` names no duration;
+     * its wait_minutes function names one in minutes. A participant told to wait about a minute
+     * sent ten computer tool waits in one turn, which lasts 50 s at this length; one wait a turn
+     * makes a one-minute wait about six turns. It is also the shortest a watch lasts and how often
+     * it looks.
      */
     defaultIdleMs: 5_000,
     /**
      * How long a wait that names no duration lasts after the participant acts in the same turn, so
-     * the screen can settle before the next screenshot. Nearly every OpenAI computer-use wait follows
-     * a click or keypress this way, so a longer one would slow every run. A watch looks again this
-     * soon after a large part of the screen moved.
+     * the screen can settle before the next screenshot. Nearly every OpenAI computer tool wait
+     * follows a click or keypress this way, so a longer one would slow every run. A watch looks again
+     * this soon after a large part of the screen moved.
      */
     settleMs: 500,
     /**

package/dist/actors/contract.d.ts

@@ -91,6 +91,10 @@ export interface ActorTraceItem {
      *  ran in place of a turn that only waited. Additive: absent on plain waits, on other items and
      *  producers, and in older bundles. */
     watch?: ActorWatch;
+    /** On a computer-use wait's `ui_action`: the length in milliseconds the participant named for
+     *  it, before any cap. Absent on a wait that named no length, such as the OpenAI computer
+     *  tool's `wait`, on other items and producers, and in older bundles. */
+    namedMs?: number;
 }
 /**
  * A watch over the screen while a computer-use participant only waited: the loop looked every

package/dist/actors/local-agent/cli.js

@@ -190,11 +190,11 @@ export function promptFor(request, screenshotPath) {
             "giving up, and put your closing words in message. When done=true, set outcome: reached if " +
             "the task is finished, blocked if something in the app stopped you, not_reached if you are " +
             "stopping for another reason. Otherwise outcome is null.",
-        "A turn whose actions are only waits ends when the screen changes and holds still, or when its " +
-            "waits' ms pass. While no change on the screen holds still, each further turn in a row that " +
-            "only waits lasts twice as long as the one before, up to the study's longest wait, and the note " +
-            "from the harness says how long you waited and why it ended. A wait among other actions lasts " +
-            "its ms.",
+        "A turn whose actions are only waits and that asks for some wait time asks to wait its waits' " +
+            "ms together; an ask shorter than a wait whose ms is null counts as one, and named ms count " +
+            "up to the study's longest wait. The note from the harness says how long you waited and why " +
+            "it ended. A wait among other actions lasts its ms, and the note says when the study's limit " +
+            "for one wait shortened it.",
         `Reply with ONLY a JSON object of this shape: ${shape}`,
         hint,
     ].join("\n");

package/dist/evidence/json-split.d.ts

@@ -0,0 +1,21 @@
+/** The JSON text of a value cut around the elements of one of its arrays. */
+export interface ArraySplit {
+    /** The array's elements, read as JSON.stringify reads them. */
+    readonly elements: readonly Record<string, unknown>[];
+    /** The value's JSON text up to and including the array's `[`. */
+    before(): string;
+    /** The value's JSON text from the array's `]` on. */
+    after(): string;
+}
+/**
+ * The cut of JSON.stringify(value) around the elements of its array `value[key]`, when that text
+ * holds each element's text as JSON.stringify(element) writes it: `value` is a plain object that
+ * has `key` among its own enumerable keys, `value[key]` is a plain array with no holes, and each
+ * element is a plain object. A plain object has Object.prototype or null as its prototype, a plain
+ * array Array.prototype, and neither has a toJSON. Otherwise undefined: the caller needs the whole
+ * text. Getters, proxies and a toJSON that changes `value` while it is serialized are not detected:
+ * the elements are read before anything is serialized. before() and after() serialize the members
+ * on their side of the array when called, so a caller that calls before(), serializes each element
+ * and then calls after() runs every toJSON in the order JSON.stringify(value) runs them.
+ */
+export declare function splitAtArray(value: unknown, key: string): ArraySplit | undefined;

package/dist/evidence/json-split.js

@@ -0,0 +1,57 @@
+// When the JSON text of a value can be worked on one element of an array at a time. A run bundle
+// holds every participant's trace in its `streams` array, and the bundle's whole text can pass
+// V8's longest string, 536,870,888 characters on Node 24.
+//
+// JSON.stringify calls a toJSON with the value's key in its parent, and an element serialized
+// alone gets "" in place of its index. It writes a boxed primitive as the primitive. A plain object
+// or array with no toJSON is written as its own keys or items wherever it sits, and every value
+// inside an element gets the same key alone as inside the whole value.
+import { isRecord } from "../run/type-guards.js";
+/**
+ * The cut of JSON.stringify(value) around the elements of its array `value[key]`, when that text
+ * holds each element's text as JSON.stringify(element) writes it: `value` is a plain object that
+ * has `key` among its own enumerable keys, `value[key]` is a plain array with no holes, and each
+ * element is a plain object. A plain object has Object.prototype or null as its prototype, a plain
+ * array Array.prototype, and neither has a toJSON. Otherwise undefined: the caller needs the whole
+ * text. Getters, proxies and a toJSON that changes `value` while it is serialized are not detected:
+ * the elements are read before anything is serialized. before() and after() serialize the members
+ * on their side of the array when called, so a caller that calls before(), serializes each element
+ * and then calls after() runs every toJSON in the order JSON.stringify(value) runs them.
+ */
+export function splitAtArray(value, key) {
+    // JSON.stringify writes only own enumerable keys.
+    if (!isPlainRecord(value))
+        return undefined;
+    const keys = Object.keys(value);
+    const at = keys.indexOf(key);
+    if (at === -1)
+        return undefined;
+    const array = value[key];
+    if (!isPlainArray(array))
+        return undefined;
+    // JSON.stringify reads the length once and then each index, so a hole reads as undefined and an
+    // own iterator is never called. Array.from would call that iterator, and every skips holes.
+    const elements = [];
+    for (let index = 0, length = array.length; index < length; index += 1)
+        elements.push(array[index]);
+    if (!elements.every(isPlainRecord))
+        return undefined;
+    // fromEntries keeps a key such as __proto__ an own property.
+    const members = (from, to) => Object.fromEntries(keys.slice(from, to).map((name) => [name, value[name]]));
+    return {
+        elements,
+        before: () => JSON.stringify({ ...members(0, at), [key]: [] }).slice(0, -"]}".length),
+        after: () => {
+            const text = JSON.stringify(members(at + 1));
+            return text === "{}" ? "]}" : `],${text.slice(1)}`;
+        },
+    };
+}
+const hasToJson = (value) => typeof value.toJSON === "function";
+function isPlainRecord(value) {
+    if (!isRecord(value) || hasToJson(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+const isPlainArray = (value) => Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype && !hasToJson(value);

package/dist/evidence/redaction.d.ts

@@ -14,6 +14,8 @@ export declare const REDACTION_MARKERS: {
 export declare function sensitivePatterns(): readonly RegExp[];
 /** True if the text contains a credential. Local paths and a URL on an E2B host alone do not count. */
 export declare function containsCredential(text: string): boolean;
+/** True if the text contains a URL on an E2B host, as containsSensitive reads one. */
+export declare function containsSandboxUrl(text: string): boolean;
 /** True if the text contains any secret-shaped token or known local path. */
 export declare function containsSensitive(text: string): boolean;
 /**

package/dist/evidence/redaction.js

@@ -76,6 +76,10 @@ const E2B_PUBLIC_PAGE = [
 // A stream URL's auth key rides its `password` parameter, 16 characters from the SDK, which the
 // credential parameter pattern matches as well.
 const SANDBOX_URL = new RegExp(String.raw `(?!https:\/\/(?:${E2B_PUBLIC_PAGE})[.,;:!?'")]*(?:\s|$))https?:\\?\/\\?\/(?:[^/\s@]*@)*[^/\s\\"'<>@]*e2b[^)\s]+`, "gi");
+// src/evidence/sensitive-json.ts scans a JSON array one element at a time and relies on which of
+// these patterns can match across the `},{` between two elements. A new pattern that can cross
+// those characters needs a case in tests/evidence/sensitive-json.test.ts.
+//
 // A pattern that matches a credential by its context puts the context in a `keep` group, which
 // redaction leaves in place: `?token=[REDACTED_SECRET]`. Context goes in a group and not in a
 // lookbehind, because a pattern that starts with a lookbehind is tried at every position of the
@@ -174,6 +178,10 @@ const CREDENTIAL_PATTERNS = SECRET_PATTERNS.filter((pattern) => pattern !== SAND
 export function containsCredential(text) {
     return CREDENTIAL_PATTERNS.some((pattern) => matchesPattern(pattern, text));
 }
+/** True if the text contains a URL on an E2B host, as containsSensitive reads one. */
+export function containsSandboxUrl(text) {
+    return matchesPattern(SANDBOX_URL, text);
+}
 /** True if the text contains any secret-shaped token or known local path. */
 export function containsSensitive(text) {
     return (containsSecret(text) || LOCAL_PATH_PATTERNS.some(([pattern]) => matchesPattern(pattern, text)));

package/dist/evidence/sensitive-json.d.ts

@@ -0,0 +1,9 @@
+/**
+ * containsSensitive(JSON.stringify(value)), with each element of the array `value[key]` serialized
+ * and scanned on its own, so no one string holds two elements. Only an array of plain objects is
+ * scanned that way. Any other array, and a value, array or element with a toJSON or a prototype of
+ * its own, is scanned as the whole text, which can be longer than one string holds. Getters and
+ * proxies are not detected, so the answer is the whole text's for values as JSON.parse returns
+ * them.
+ */
+export declare function containsSensitiveJson(value: unknown, key: string): boolean;

package/dist/evidence/sensitive-json.js

@@ -0,0 +1,73 @@
+// containsSensitive over a JSON document that may not fit in one string. V8's longest string is
+// 536,870,888 characters on Node 24, and a run with every participant's trace loaded can pass it.
+//
+// The document is scanned as pieces: the text before the array and its first element, each
+// element after that, and the last element with the text after the array. Every cut then falls on
+// the `,` between two objects, `},{`. Most patterns stop at a quote, so a match stays inside one
+// JSON string. Those that read a name and its value cross only the quotes around its `:`. A
+// credential variable's unquoted value runs over brackets and braces up to a comma, so at a cut it
+// stops, but after the last element it can run over the array's `]`. That is why the text after
+// the array joins the last element.
+//
+// The sandbox URL can cross a cut. Its user info runs over quotes, braces and commas up to an `@`:
+// `https://host"},{"contact":"ops@e2b-host`. From the end of its scheme to one character past
+// `e2b`, that match holds no slash and no whitespace. So a match across a cut starts at a scheme
+// with no slash or whitespace after it up to the cut, and reaches the next piece only up to its
+// first slash or whitespace. Between that scheme and the cut, the match can only be in its user
+// info. The scheme and every `@` there are inside JSON strings, so a host that starts after one
+// stops at its string's closing quote. Had that host reached `e2b` first, the scan of its piece or
+// an earlier junction would have matched. So the scan keeps only the scheme between pieces. Each
+// cut's junction scans the scheme, `"}` in place of the text after it, the cut's `,` and the next
+// piece up to its first slash or whitespace. A public E2B page after the scheme would need a space
+// or the text's end before the cut, so neither text exempts the URL. The scan holds one piece at a
+// time.
+import { splitAtArray } from "./json-split.js";
+import { containsSandboxUrl, containsSensitive } from "./redaction.js";
+// The sandbox URL's scheme, `https://` or `https:\/\/` as JSON may escape it, at a text's end.
+const SCHEME_AT_END = /https?:\\?\/\\?\/$/i;
+const SLASH_OR_SPACE = /[/\s]/;
+/**
+ * containsSensitive(JSON.stringify(value)), with each element of the array `value[key]` serialized
+ * and scanned on its own, so no one string holds two elements. Only an array of plain objects is
+ * scanned that way. Any other array, and a value, array or element with a toJSON or a prototype of
+ * its own, is scanned as the whole text, which can be longer than one string holds. Getters and
+ * proxies are not detected, so the answer is the whole text's for values as JSON.parse returns
+ * them.
+ */
+export function containsSensitiveJson(value, key) {
+    const split = splitAtArray(value, key);
+    if (split === undefined)
+        return wholeTextSensitive(value);
+    const { elements } = split;
+    const [prefix, suffix] = [split.before(), split.after()];
+    if (elements.length === 0)
+        return containsSensitive(prefix + suffix);
+    // The scheme of a URL no slash or whitespace has followed, from an earlier piece.
+    let scheme;
+    for (const [index, element] of elements.entries()) {
+        const own = JSON.stringify(element);
+        const piece = (index === 0 ? prefix : "") + own + (index === elements.length - 1 ? suffix : "");
+        if (containsSensitive(piece))
+            return true;
+        if (scheme !== undefined && containsSandboxUrl(`${scheme}"},${head(piece)}`))
+            return true;
+        scheme = schemeAfter(scheme, piece);
+    }
+    return false;
+}
+const wholeTextSensitive = (value) => containsSensitive(JSON.stringify(value) ?? "");
+/** `piece` up to and including its first slash or whitespace, or all of it when it has none. */
+function head(piece) {
+    const at = piece.search(SLASH_OR_SPACE);
+    return at === -1 ? piece : piece.slice(0, at + 1);
+}
+/** The scheme a sandbox URL could continue from after `piece`, given the one before it. */
+function schemeAfter(before, piece) {
+    let last = piece.length - 1;
+    while (last >= 0 && !SLASH_OR_SPACE.test(piece[last]))
+        last -= 1;
+    if (last === -1)
+        return before;
+    // `https:\/\/` is the longest scheme: ten characters ending at the slash.
+    return SCHEME_AT_END.exec(piece.slice(Math.max(0, last - 9), last + 1))?.[0];
+}

package/dist/routes/computer-use/local-vm.js

@@ -1,5 +1,6 @@
 import { collectDesktopRecording } from "../../evidence/desktop-recording-artifact.js";
 import path from "node:path";
+import { participantList } from "../../study/study-fields.js";
 import { inboxRecipientFor, } from "./participant-desktop.js";
 import { createLocalFirecrackerDesktop, } from "../../substrates/local/firecracker-desktop.js";
 import { localBrowserDefaults, localBrowserUnsupportedReason, } from "../../substrates/local/runtime-config.js";
@@ -139,11 +140,16 @@ function createLocalParticipantDesktop(context, run, warnings, artifactRoot) {
     };
 }
 /** The Codex account participant, whose unconfirmed cleanup blocks the study's analysis. */
-function accountProvider(state, maxWaitMs) {
-    return async ({ executor }) => {
+function accountProvider(state, config) {
+    return async ({ executor, participant: { index } }) => {
+        // The wait settings the participant's loop runs with (plan-participants.ts), so its tool
+        // description states them.
+        const maxWaitMs = config.actor?.maxWaitMs;
+        const idleWaitMs = participantList(config)?.[index]?.idleWaitMs ?? config.actor?.idleWaitMs;
         const participant = createRestrictedCodexParticipant({
             speechEnabled: executor.speechEnabled === true,
             ...(maxWaitMs === undefined ? {} : { maxWaitMs }),
+            ...(idleWaitMs === undefined ? {} : { idleWaitMs }),
         });
         state.participants.push(participant);
         const provider = Object.assign(participant.provider, {
@@ -185,7 +191,7 @@ export function prepareLocalVmRun(options) {
     const { config: _config, assets: _assets, signal: _signal, ...runOptions } = options;
     return {
         options: account
-            ? { ...runOptions, createProvider: accountProvider(state, config.actor?.maxWaitMs) }
+            ? { ...runOptions, createProvider: accountProvider(state, config) }
             : runOptions,
         localVm: {
             desktop: (run, warnings, artifactRoot) => createLocalParticipantDesktop(context, run, warnings, artifactRoot),

package/dist/routes/computer-use/participant-model.js

@@ -47,6 +47,9 @@ export async function startParticipantModel(spec, deps, executor) {
             ...(spec.planned.limits.maxWaitMs === undefined
                 ? {}
                 : { maxWaitMs: spec.planned.limits.maxWaitMs }),
+            ...(spec.planned.limits.idleWaitMs === undefined
+                ? {}
+                : { idleWaitMs: spec.planned.limits.idleWaitMs }),
             session: { env },
         });
         return { provider: codexParticipant.provider, codexParticipant };

package/dist/run/sandbox-ids.d.ts

@@ -4,7 +4,12 @@ import { type PreparedRunArtifactPaths } from "./paths.js";
 export declare function scrubSandboxIds(text: string, ids: Iterable<string>, label?: (id: string) => string): string;
 /**
  * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
- * digest, and any raw id left in free text or a URL becomes its label.
+ * digest, and any raw id left in free text, a key or a URL becomes its label. When no label goes
+ * in, the result is the key-redacted value. Otherwise it is what JSON.parse returns for the
+ * scrubbed JSON text of that value. A run bundle is scrubbed one stream at a time, so no string
+ * holds two streams unless a member outside `streams` holds them too. An id that holds one of
+ * {}[],:"\ makes the scrub work on the whole text, which throws RangeError for a bundle past V8's
+ * longest string. No E2B id holds one.
  */
 export declare function publicSandboxView<T>(value: T, ids: Iterable<string>): T;
 /**

package/dist/run/sandbox-ids.js

@@ -4,6 +4,7 @@
 // so output an agent pastes into an issue never carries an id.
 import { opendir, realpath } from "node:fs/promises";
 import path from "node:path";
+import { splitAtArray } from "../evidence/json-split.js";
 import { readPlainText } from "../evidence/plain-text.js";
 import { collectSandboxIds, redactSandboxIds, sandboxIdDigest, REDACTED_SANDBOX_ID, } from "../evidence/redaction.js";
 import { ContainedReadRefusedError, readContainedRegularFile, refusalText, RUN_ARTIFACT_MAX_BYTES, writeContainedOutputFile, } from "./contained-output.js";
@@ -26,20 +27,79 @@ export function scrubSandboxIds(text, ids, label = sandboxIdLabel) {
     unique.sort((left, right) => right.length - left.length);
     return unique.reduce((current, id) => current.split(id).join(label(id)), text);
 }
+// A run bundle holds every finished participant's trace, and its whole JSON text can pass V8's
+// longest string, 536,870,888 characters on Node 24. publicSandboxView scrubs such a bundle in
+// pieces: the shell, which is the bundle's JSON text with `streams` written as `[]`, and the JSON
+// text of each stream on its own. The pieces give what the whole text gives:
+// - An id that holds none of {}[],:"\ lies inside one token of the whole text. Each cut between
+//   pieces falls between two of the characters {}[], and the placeholder adds only [ and ], so no
+//   occurrence crosses a cut. A replacement leaves those characters in place, so the next id's
+//   occurrences cannot cross one either.
+// - A label holds no quote or backslash, so it never moves the end of a string. A label inside an
+//   escape, a number, true, false or null makes its piece fail to parse, and the whole text fails
+//   the same way.
+// - JSON.stringify writes a stream's members alone as it writes them inside the bundle, since each
+//   gets the same key for its toJSON. Only the stream itself would get "" in place of its index,
+//   and splitAtArray takes no stream with a toJSON. The members before `streams`, each stream and
+//   the members after are serialized in that order, which is the order the whole text runs each
+//   toJSON in.
+// - The parsed shell keeps its keys in the order JSON.parse gives for the whole text, and the
+//   streams go in at the place of `streams`. A key a label went into holds the label's `[`, so no
+//   other key becomes `streams`. An id inside the key `streams` itself takes the whole text.
+// - Once a label goes in, the view is parsed from the scrubbed pieces, as it was from the whole
+//   text. A piece kept as given could run a toJSON or getter again when the view is written.
+// - All of this holds for a bundle that serializing leaves unchanged, as every bundle JSON.parse
+//   returns is. splitAtArray reads the streams before any toJSON runs.
+/** The characters that let an id reach past one token of a JSON text or move where a string ends. */
+const CROSSES_TOKENS = /[{}[\],:"\\]/;
+/** Whether every occurrence of `id` in a bundle's JSON text stays inside one piece. */
+const staysInOnePiece = (id) => id.length === 0 || (!CROSSES_TOKENS.test(id) && !"streams".includes(id));
 /**
  * `value` as it may be written or returned: ids at the sandbox-id keys become the marker and a
- * digest, and any raw id left in free text or a URL becomes its label.
+ * digest, and any raw id left in free text, a key or a URL becomes its label. When no label goes
+ * in, the result is the key-redacted value. Otherwise it is what JSON.parse returns for the
+ * scrubbed JSON text of that value. A run bundle is scrubbed one stream at a time, so no string
+ * holds two streams unless a member outside `streams` holds them too. An id that holds one of
+ * {}[],:"\ makes the scrub work on the whole text, which throws RangeError for a bundle past V8's
+ * longest string. No E2B id holds one.
  */
 export function publicSandboxView(value, ids) {
     const redacted = redactSandboxIds(value);
     const known = [...ids];
     if (known.length === 0)
         return redacted;
-    const text = JSON.stringify(redacted);
+    const split = known.every(staysInOnePiece) ? splitAtArray(redacted, "streams") : undefined;
+    return (split === undefined ? wholeTextView(redacted, known) : streamwiseView(redacted, split, known));
+}
+/** The scrub of `value`'s whole JSON text, parsed back when a label went in. */
+function wholeTextView(value, ids) {
+    const text = JSON.stringify(value);
     if (text === undefined)
-        return redacted;
-    const scrubbed = scrubSandboxIds(text, known);
-    return (scrubbed === text ? redacted : JSON.parse(scrubbed));
+        return value;
+    const scrubbed = scrubSandboxIds(text, ids);
+    return scrubbed === text ? value : JSON.parse(scrubbed);
+}
+/** The bundle's whole-text scrub, built from its shell and each stream scrubbed on its own. */
+function streamwiseView(bundle, split, ids) {
+    const before = split.before();
+    let changed = false;
+    // Each stream is parsed at its turn, even before any label goes in, since a later piece can still
+    // take one and by then the earlier streams' text is gone.
+    const streams = split.elements.map((stream) => {
+        const text = JSON.stringify(stream);
+        const scrubbed = scrubSandboxIds(text, ids);
+        if (scrubbed !== text)
+            changed = true;
+        return JSON.parse(scrubbed);
+    });
+    const shellText = before + split.after();
+    const shell = scrubSandboxIds(shellText, ids);
+    if (!changed && shell === shellText)
+        return bundle;
+    // Assigning to `streams` keeps its place among the keys.
+    const view = JSON.parse(shell);
+    view.streams = streams;
+    return view;
 }
 /** The raw sandbox ids a receipts journal names. */
 function receiptSandboxIds(journal) {

package/dist/study/bundle-estimate.d.ts

@@ -16,6 +16,8 @@ export interface BundleEstimate {
     readonly runFileBytes: number;
     /** The largest participant trace file, which analysis also reads whole. */
     readonly largestTraceBytes: number;
+    /** Every participant's trace file together, whose items the Observer page joins in one string. */
+    readonly tracesBytes: number;
     /** observer/index.html, which verify reads whole. */
     readonly observerPageBytes: number;
     /** Every file, screenshots included. */

package/dist/study/bundle-estimate.js

@@ -16,6 +16,13 @@
 // observer-data.json leaves the lists out too and was 0.94 to 1.12 of run.json's size on the live
 // runs measured, so it passes 32 MiB only after run.json passes 16 MiB, and the estimate does not
 // check it.
+// The Observer page and the Observer server join every participant's items in one string before
+// gzip. A bundle export renders the Observer page, so it fails there too once --max-bytes is
+// raised past its 25 MiB default, which refuses such a run first. Writing run.json joins none: the
+// sandbox id scrub (publicSandboxView) works one participant at a time. V8's longest string is
+// 536,870,888 characters on Node 24. A trace file's bytes are at least the characters of its
+// items as compact JSON, so the estimate compares the traces' bytes and may warn a little early.
+import { constants } from "node:buffer";
 import { EVIDENCE_LIMITS } from "../analysis/analysis-limits.js";
 import { RUN_ARTIFACT_MAX_BYTES } from "../run/contained-output.js";
 import { formatDuration } from "../run/projection.js";
@@ -156,6 +163,7 @@ export function estimateBundle(participants, sessionMs) {
     return {
         runFileBytes,
         largestTraceBytes: largestTrace,
+        tracesBytes: traces,
         observerPageBytes,
         // observer-data.json is about run.json's size.
         totalBytes: observerPageBytes + screenshots * RATES.screenshotBytes + traces + 2 * runFileBytes,
@@ -178,6 +186,7 @@ export function estimateBundle(participants, sessionMs) {
 export function bundleLimitReason(estimate) {
     const runFile = estimate.runFileBytes > EVIDENCE_LIMITS.sourceBytes;
     const page = estimate.observerPageBytes > RUN_ARTIFACT_MAX_BYTES;
+    const joined = estimate.tracesBytes > constants.MAX_STRING_LENGTH;
     const entries = estimate.entries > estimate.entryLimit;
     const passed = [
         ...(runFile
@@ -195,6 +204,11 @@ export function bundleLimitReason(estimate) {
                 `The Observer page, observer/index.html, may grow to about ${mib(estimate.observerPageBytes)}, past the ${mib(RUN_ARTIFACT_MAX_BYTES)} verify reads in one file.`,
             ]
             : []),
+        ...(joined
+            ? [
+                `All participants' traces together may grow to about ${mib(estimate.tracesBytes)}, past the ${mib(constants.MAX_STRING_LENGTH)} that fits in one string. The Observer page puts all their items in one string, so the page would not build. A bundle export allowed past its 25 MiB default renders that page, so it would fail too.`,
+            ]
+            : []),
         ...(entries
             ? [
                 `The run may hold about ${count(estimate.entries)} files and folders, past the ${count(estimate.entryLimit)} the public-safety scan reads in a run of ${plural(estimate.basis.participants, "participant")}.`,
@@ -222,7 +236,7 @@ export function bundleLimitReason(estimate) {
         ...(runFile ? ["shorten the mission (actor.mission)"] : []),
     ];
     // A trace is one participant's, so splitting the study helps only the run's own files.
-    if (runFile || page || entries || changes.length === 0)
+    if (runFile || page || joined || entries || changes.length === 0)
         changes.push("split the participants across studies");
     const advice = changes.length < 2
         ? changes.join("")

package/dist/study/types.d.ts

@@ -414,10 +414,11 @@ export interface StudyActor {
     maxWaitMs?: number;
     /**
      * Computer-use and shared-world: how long a `wait` that names no duration lasts when the
-     * participant's turn only waits or takes screenshots, and how often the loop looks at the screen
-     * while it watches such a turn, in whole milliseconds from 1000 to 600000 and no longer than
-     * maxWaitMs. Default 5000. After an action in the same turn such a wait lasts 500 ms. OpenAI's
-     * computer-use `wait` never names a duration.
+     * participant's turn only waits or takes screenshots, the shortest such a turn is watched for,
+     * and how often the loop looks at the screen while it watches such a turn, in whole milliseconds
+     * from 1000 to 600000 and no longer than maxWaitMs. Default 5000. After an action in the same
+     * turn such a wait lasts 500 ms. OpenAI's computer tool `wait` never names a duration; its
+     * wait_minutes function does.
      */
     idleWaitMs?: number;
     /**

package/dist/verify/verify.js

@@ -2,7 +2,8 @@ import path from "node:path";
 import { listAnalysisExecutions } from "../analysis/store-executions.js";
 import { loadAnalysis } from "../analysis/load.js";
 import { analysisSharingProblems } from "../analysis/sharing.js";
-import { containsSensitive, REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
+import { REDACTED_SANDBOX_ID } from "../evidence/redaction.js";
+import { containsSensitiveJson } from "../evidence/sensitive-json.js";
 import { keyedSandboxIds, readRunSandboxIds } from "../run/sandbox-ids.js";
 import { validatePreparedRunArtifactPaths } from "../run/paths.js";
 import { isReadRunBundleSchema, RUN_BUNDLE_FILE, RUN_BUNDLE_SCHEMA, RUN_BUNDLE_V1_SCHEMA, RUN_BUNDLE_V2_SCHEMA, RUN_BUNDLE_V3_SCHEMA, } from "../run/bundle.js";
@@ -112,9 +113,10 @@ export async function verifyResolvedRun(cwd, runInput, runPaths) {
     addTraceScan(traces, publicSafetyFindings, unscannedArtifacts);
     // JSON escapes can hide a sensitive value from the byte scan while the
     // decoded recording exposes it to Observer, feedback, or analysis input.
+    // Each participant is scanned apart: together their traces can pass V8's longest string.
     if (publicSafetyFindings.length < MAX_REPORTED_FINDINGS &&
         recorded !== null &&
-        containsSensitive(JSON.stringify(recorded))) {
+        containsSensitiveJson(recorded, "streams")) {
         publicSafetyFindings.push("sensitive decoded run.json");
     }
     checks.push({

package/docs/architecture/actor-contract.md

@@ -176,6 +176,7 @@ export interface ActorTraceItem {
     looks: number;
     area?: { x: number; y: number; width: number; height: number }; // pixels, coordinates only
   };
+  namedMs?: number; // computer-use wait ui_action: the length the participant named, before any cap
 }
 
 export interface ActorCapabilities {

package/docs/architecture/browser-control.md

@@ -110,8 +110,8 @@ with speech, whose heard speech reaches the participant only with a screenshot),
 shortened` notice with both durations when it does, and sends the rest as consecutive waits of at
 most 30 seconds. The Codex participant's `humanish_ui` schema leaves a wait's length open for that
 reason; the wire still refuses a single wait over 30 seconds. A wait that names no duration, as
-every OpenAI computer-use wait does, reaches the desktop with a length too: 500 ms after an action
-in the same turn. A turn that only waits or takes screenshots sends no wait to the desktop: the
+the OpenAI computer tool's `wait` does, reaches the desktop with a length too: 500 ms after an
+action in the same turn. A turn that only waits or takes screenshots sends no wait to the desktop: the
 loop observes the screen every `actor.idleWaitMs` until it changes or the wait's time passes
 (`src/actors/computer-use/loop/watch.ts`), so a waiting participant costs one observe request per
 look.

package/docs/contracts/schemas.md

@@ -1082,14 +1082,17 @@ Core-owned fields:
   16 pixels counts once it holds still at a look; one of 24 tiles or fewer once
   it has held still for more than 65 s with no tile within 4 tiles of it ticking
   or moving with a region of more than 24 tiles
-  (`src/evidence/frame-change.ts`). The first watch lasts the turn's planned
-  length: the named waits' lengths, together up to `actor.maxWaitMs` (else
-  600000), and `idleWaitMs` for each wait that names none. Each further one in a row that ended
-  at its limit, or that a change of 24 tiles or fewer woke, lasts twice as long,
-  up to the larger of its planned length and that cap. `limitMs` is how long it
-  could last; `askedMs` is what the turn's waits asked for, the same sum with no
-  cap, so it is above `limitMs` when the named waits passed the cap and below it
-  when the watch grew; `wake` is `changed`, `speech`,
+  (`src/evidence/frame-change.ts`). The first watch's limit is the turn's
+  planned length: the named waits' lengths, together up to `actor.maxWaitMs` (else
+  600000), and `idleWaitMs` for each wait that names none, and at least
+  `idleWaitMs`. Each further one in a row that ended at its limit, or that a
+  change of 24 tiles or fewer woke, lasts twice as long, up to the larger of its
+  planned length and that cap. An OpenAI participant names a length with the
+  `wait_minutes` function tool; its computer tool's `wait` names none.
+  `limitMs` is how long it could last; `askedMs` is what the turn's
+  waits asked for, the same sum with no cap, so it is above `limitMs` when the
+  named waits passed the cap and below it when the watch grew or the named waits
+  were shorter than `idleWaitMs`; `wake` is `changed`, `speech`,
   `condition`, `limit`, `clock` (wind-down or end), `stalled` (a look got no
   frame; the next observation is a fresh one), or `stopped` (the study budget or
   the session's time ran out); `looks` counts its looks; `area` (`x`, `y`,
@@ -1100,6 +1103,14 @@ Core-owned fields:
   waits after the one carrying `watch` are titled `wait 0ms`. The look that
   ended a watch is the turn's `turn-NN` screenshot; other looks are not kept.
   Additive: absent on plain waits, other producers and older bundles
+- optional `items[].namedMs`, on the computer-use `ui_action` of each wait that
+  named its length: that length in milliseconds, as the participant named it,
+  before `actor.maxWaitMs` or the watch's cap applied. An OpenAI participant
+  names a length only through `wait_minutes`, so its waits with `namedMs` are
+  that tool's calls. Its waits without it are the computer tool's `wait`, a
+  `wait_minutes` call whose minutes were not a finite number above zero, and
+  a call to a function it does not have. Additive: absent on waits that named
+  none, other items and producers, and older bundles
 - optional `items[].page` and `finalPage` (`{ origin, path }`, `TracePage` in
   `src/actors/contract.ts`): where a computer-use participant's browser was. The loop puts `page`
   on the `screenshot` item of each observation that read a URL: `turn-00-start` is the page before
@@ -1183,8 +1194,9 @@ Core-owned fields:
   with the outputs that answered it, and the latest reply. Past an estimated
   64,000 input tokens it is cut down to 32,000 in one step: the opening
   screenshot is dropped first, then the oldest exchanges become lines of a note,
-  sent as an assistant message, that keeps their reasoning summaries, messages
-  and actions as text, with any text that came back with their screenshots.
+  sent as an assistant message, that keeps their reasoning summaries, messages,
+  actions and `wait_minutes` calls as text, with any text that came back with
+  their screenshots or in a function call's output, such as how a wait ended.
   Past 32,000 characters the note keeps its first four lines and its newest
   ones, and names the turns between them as not listed.
   The two newest exchanges are always carried whole, even when they alone pass

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "humanish",
-  "version": "0.132.0",
+  "version": "0.133.1",
   "description": "Synthetic user research for apps, CLIs, and agent-facing product flows.",
   "keywords": [
     "cli",